Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/10/2026, 20:12
General
- Target jaffacakes118_Trojan-PSW.Win32.Tepfer.psxtlb.exe
- Size 5.3MB
- Sample261012-yywp7aav7n
- SHA256 4ff3b1e4fc22e22e9560420c97a239935e2de193683bffaa6424fe74283f24c0
Malware Config
Extracted
-
lokibot
-
http://techlity.com/Panel/five/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Family: Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-PSW.Win32.Tepfer.psxtlb.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-PSW.Win32.Tepfer.psxtlb.exe"1⤵
- Enumerates connected drives
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-PSW.Win32.Tepfer.psxtlb.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-PSW.Win32.Tepfer.psxtlb.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/456-0-0x0000000000400000-0x00000000005B9000-memory.dmp
memory/456-1-0x00000000024E0000-0x0000000002522000-memory.dmp
memory/456-3-0x0000000002490000-0x0000000002491000-memory.dmp
memory/456-2-0x0000000002580000-0x0000000002581000-memory.dmp
memory/456-47-0x0000000002AA0000-0x0000000002AA1000-memory.dmp
memory/456-46-0x0000000002AB0000-0x0000000002AB1000-memory.dmp
memory/456-54-0x0000000003560000-0x0000000003561000-memory.dmp
memory/456-53-0x0000000003570000-0x0000000003571000-memory.dmp
memory/456-52-0x0000000003520000-0x0000000003521000-memory.dmp
memory/456-51-0x0000000003540000-0x0000000003541000-memory.dmp
memory/456-50-0x0000000003510000-0x0000000003511000-memory.dmp
memory/456-48-0x0000000003500000-0x0000000003501000-memory.dmp
memory/456-45-0x0000000002A80000-0x0000000002A81000-memory.dmp
memory/456-44-0x0000000002A90000-0x0000000002A91000-memory.dmp
memory/456-40-0x0000000002A40000-0x0000000002A41000-memory.dmp
memory/456-39-0x0000000002A10000-0x0000000002A11000-memory.dmp
memory/456-38-0x0000000002A20000-0x0000000002A21000-memory.dmp
memory/456-37-0x00000000029F0000-0x00000000029F1000-memory.dmp
memory/456-36-0x0000000002A00000-0x0000000002A01000-memory.dmp
memory/456-35-0x00000000029D0000-0x00000000029D1000-memory.dmp
memory/456-34-0x00000000029E0000-0x00000000029E1000-memory.dmp
memory/456-33-0x00000000028B0000-0x00000000028B1000-memory.dmp
memory/456-31-0x0000000002890000-0x0000000002891000-memory.dmp
memory/456-30-0x00000000028A0000-0x00000000028A1000-memory.dmp
memory/456-29-0x0000000002870000-0x0000000002871000-memory.dmp
memory/456-28-0x0000000002880000-0x0000000002881000-memory.dmp
memory/456-26-0x0000000002860000-0x0000000002861000-memory.dmp
memory/456-24-0x0000000002840000-0x0000000002841000-memory.dmp
memory/456-19-0x00000000027C0000-0x00000000027C1000-memory.dmp
memory/456-16-0x00000000027A0000-0x00000000027A1000-memory.dmp
memory/456-12-0x00000000026C0000-0x00000000026C1000-memory.dmp
memory/456-11-0x0000000002700000-0x0000000002701000-memory.dmp
memory/456-49-0x0000000003530000-0x0000000003531000-memory.dmp
memory/456-43-0x0000000002A60000-0x0000000002A61000-memory.dmp
memory/456-42-0x0000000002A70000-0x0000000002A71000-memory.dmp
memory/456-41-0x0000000002A30000-0x0000000002A31000-memory.dmp
memory/456-32-0x00000000028C0000-0x00000000028C1000-memory.dmp
memory/456-27-0x0000000002850000-0x0000000002851000-memory.dmp
memory/456-25-0x0000000002820000-0x0000000002821000-memory.dmp
memory/456-23-0x0000000002800000-0x0000000002801000-memory.dmp
memory/456-22-0x0000000002810000-0x0000000002811000-memory.dmp
memory/456-21-0x00000000027E0000-0x00000000027E1000-memory.dmp
memory/456-20-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/456-18-0x00000000027D0000-0x00000000027D1000-memory.dmp
memory/456-15-0x00000000027B0000-0x00000000027B1000-memory.dmp
memory/456-17-0x0000000002770000-0x0000000002771000-memory.dmp
memory/456-13-0x00000000026D0000-0x00000000026D1000-memory.dmp
memory/456-14-0x0000000002710000-0x0000000002711000-memory.dmp
memory/456-10-0x0000000002790000-0x0000000002791000-memory.dmp
memory/456-8-0x00000000026E0000-0x00000000026E3000-memory.dmp
memory/456-9-0x0000000002780000-0x0000000002781000-memory.dmp
memory/456-7-0x00000000025A0000-0x00000000025A1000-memory.dmp
memory/456-56-0x00000000038D0000-0x00000000038D1000-memory.dmp
memory/456-55-0x00000000038E0000-0x00000000038E1000-memory.dmp
memory/456-6-0x00000000026F0000-0x00000000026F2000-memory.dmp
memory/456-5-0x0000000002560000-0x0000000002561000-memory.dmp
memory/456-57-0x0000000000400000-0x00000000005B9000-memory.dmp
memory/456-59-0x0000000003900000-0x0000000003901000-memory.dmp
memory/456-58-0x00000000038F0000-0x00000000038F1000-memory.dmp
memory/456-4-0x0000000002470000-0x0000000002471000-memory.dmp
memory/456-60-0x00000000024E0000-0x0000000002522000-memory.dmp
memory/456-62-0x0000000005530000-0x0000000005531000-memory.dmp
memory/456-61-0x0000000005540000-0x0000000005541000-memory.dmp
memory/456-70-0x00000000055B0000-0x00000000055B1000-memory.dmp
memory/456-69-0x00000000055C0000-0x00000000055C1000-memory.dmp
memory/456-68-0x0000000005590000-0x0000000005591000-memory.dmp
memory/456-67-0x00000000055A0000-0x00000000055A1000-memory.dmp
memory/456-66-0x0000000005570000-0x0000000005571000-memory.dmp
memory/456-65-0x0000000005580000-0x0000000005581000-memory.dmp
memory/456-64-0x0000000005550000-0x0000000005551000-memory.dmp
memory/456-63-0x0000000005560000-0x0000000005561000-memory.dmp
memory/456-71-0x0000000005A70000-0x0000000005A71000-memory.dmp
memory/456-72-0x0000000005A60000-0x0000000005A61000-memory.dmp
memory/456-73-0x0000000003520000-0x0000000003521000-memory.dmp
memory/456-74-0x0000000000400000-0x00000000005B9000-memory.dmp
memory/456-75-0x0000000000400000-0x00000000005B9000-memory.dmp
memory/456-79-0x0000000005F60000-0x0000000005F61000-memory.dmp
memory/456-82-0x0000000005F70000-0x0000000005F71000-memory.dmp
memory/456-85-0x0000000000400000-0x00000000005B9000-memory.dmp
memory/456-84-0x00000000024E0000-0x0000000002522000-memory.dmp
memory/456-81-0x0000000005F80000-0x0000000005F81000-memory.dmp
memory/456-80-0x0000000005CA0000-0x0000000005CA1000-memory.dmp
memory/2560-76-0x0000000000400000-0x00000000004A2000-memory.dmp